Read the docs
TI-2021-19111 Aliases CVE-2021-43045GHSA-868x-rg4c-cjqg

Possible DOS vulnerabilities in C# Avro SDK

Priority LOW 38CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.

Why it matters now

EPSS 0.03057 87th percentileScored 2026-11-07
Fix Fixed Apache.Avro (NuGet): 1.11.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache AvroApache Avro – 1.10.2—No fix listedCNA
—Apache.Avro (NuGet)before 1.11.01.11.0Patch availableGHSA-868x-rg4c-cjqg
  • Apache Avro VendorApache Affected Apache Avro – 1.10.2 Fixed in — No fix listed CNA
  • Apache.Avro (NuGet) Vendor— Affected before 1.11.0 Fixed in 1.11.0 Patch available GHSA-868x-rg4c-cjqg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:avro:*:*:*:*:*:.net:*:*before 1.11.0VulnerableApache
  • cpe:2.3:a:apache:avro:*:*:*:*:*:.net:*:* Versions before 1.11.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-868x-rg4c-cjqg Apache.Avro (NuGet) Fixed in 1.11.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 13 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Operations Network 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43045
  2. 2026-10-03 Alias added: GHSA-868x-rg4c-cjqg

References

Advisory 3

Other 4

  • TI-2024-31848 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK) CVSS 4.0CRITICAL 9.2
  • TI-2023-20549 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK CVSS 3.1HIGH 7.5
  • TI-2022-16548 Integer overflow when reading corrupted .avro file in Avro Rust SDK CVSS 3.1HIGH 7.5
  • TI-2022-16547 Memory overconsumption in Avro Rust SDK CVSS 3.1HIGH 7.5
  • TI-2025-24035 Apache Avro Java SDK: Code injection on Java generated code CVSS 3.1HIGH 7.3
  • TI-2022-16171 Denial of service while reading data in Avro Rust SDK CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences